netz.exe ( C:/WINDOWS/system32 )

[zerof]

Somebody knows to say me, what *netz.exe" does?
It is being executed as a Windows XP pro service and steals 100% of the
CPU resources.
There is no information on it in the web.
TKs for all reply.

 

[Detlev Dreyer]

Somebody knows to say me, what *netz.exe" does?

"netz.exe" does not belong to Windows.

It is being executed as a Windows XP pro service and steals 100% of
the CPU resources.

Scan your system for malware (viruses, worms, trojans, spyware).

 

[David H. Lipman]

From: "zerof" <[email protected]>

| Somebody knows to say me, what *netz.exe" does?
| It is being executed as a Windows XP pro service and steals 100% of the
| CPU resources.
| There is no information on it in the web.
| TKs for all reply.
| ----
| zerof


Please submit "netz.exe" to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against 18 different AV vendor's scanners.

Another way to submit is to send the suspect file to the following email address
scan<at>virustotal.com
{ replace <at> with @ } with only the word SCAN as the subject.

Please post back the EXACT results.

After you post the results from Virus Total...

Download CLEAN.EXE from the URL --
http://www.ik-cs.com/programs/virtools/clean.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link
(.lnk) files and a PDF instruction file.

GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
Scanner. If you are using Windows XP, you may have to disable the Windows XP FireWall to
allow the FTP utility to download the needed files

CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
to scan again at a future date, run this batch file. It will automatically check the date
of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
signature files and install them before performing the scan.

DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
you have booted from an Emergency Boot Disk or DOS disk and have already executed;
c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
http://www.bootdisk.com/bootdisk.htm

I need you to perform the following...

Execute; CLEAN.EXE
Choose; Unzip
Choose; Close

Execute; c:\mcafee\GetFiles.BAT
{ or Double-click on 'GetFiles Link' in c:\mcafee }

Reboot the PC into Safe Mode [F8 key during boot]

Shutdown as many applications as possible !
It would also help for you to read - "How to perform a clean boot in Windows XP"
http://support.microsoft.com/kb/310353

Execute; c:\mcafee\CLEAN.BAT
{ or Double-click on 'Clean Link' in c:\mcafee }

 

[zerof]

Detlev Dreyer escreveu:

"netz.exe" does not belong to Windows.




Scan your system for malware (viruses, worms, trojans, spyware).

 

[Detlev Dreyer]

All the searches for these plagues, do not indicate nothing.

Well, this doesn't mean too much.

It seems to be a server who has something to see with "Network
Timetables". -----

Check the location (path) of that file and its file properties. Both
can help to determine the software where it belongs to.

 

[Detlev Dreyer]

Check the location (path) of that file

Oups, it's "C:\Windows\system32" according to the reference line.

Anyway, if you can't find out the origin, you may want to disable this
service and see what software complains. As the next step it's also a
good idea to send that file for an examination as posted by "David H.
Lipman" in this thread. Good luck!

 

[Guest]

If it's the new Netsky worm, you have been slimed.

 

[Guest]

If it's the new Netsky worm, you have been slimed.

Actually, I was thinking of something else, because this particular worm
isn't new. It doesn't change my overall answer. Update your antivirus
scanner and then scan the file.

 

[zerof]

The "netz.eze" is one SpyBot named by MacAfee as "New Malware.h=1".

http://www.cyberdefender.com/risk/html/20050502091300.log.html

Thanks to the supports technician of Microsoft and McAfee, finally I
obtained to discover that type of virus was.

McAfee has the proper procedure to remove it.

 

[David H. Lipman]

From: "zerof" <[email protected]>

|
| The "netz.eze" is one SpyBot named by MacAfee as "New Malware.h=1".
|
| http://www.cyberdefender.com/risk/html/20050502091300.log.html
|
| Thanks to the supports technician of Microsoft and McAfee, finally I
| obtained to discover that type of virus was.
|
| McAfee has the proper procedure to remove it.
|
| ----
| zerof

You should have submitted NETZ.EXE to Virus Total as I had suggested !

"New Malware.h" is a McAfee Heuristic detection.

http://vil.nai.com/vil/content/v_99302.htm